# auth0/express-jwt

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/auth0-express-jwt).**

4,512 stars · 441 forks · TypeScript · MIT

## Links

- GitHub: https://github.com/auth0/express-jwt
- awesome-repositories: https://awesome-repositories.com/repository/auth0-express-jwt.md

## Topics

`express-jwt` `jwt`

## Description

express-jwt is a middleware for Express applications that validates JSON Web Tokens to secure routes and authenticate requests. It functions as a security guard that verifies token signatures and expiration dates before allowing access to backend endpoints.

The project provides a request credential extractor to retrieve tokens from headers, cookies, or query parameters. It supports dynamic key retrieval to fetch the necessary secrets or public keys at runtime based on request attributes or token headers.

The middleware handles JSON Web Token validation, including token expiration handling and the ability to check token identifiers against revocation lists to invalidate cryptographically valid tokens. It also maps decoded payload attributes from validated tokens directly to the request object.

## Tags

### Security & Cryptography

- [JWT Authentications](https://awesome-repositories.com/f/security-cryptography/token-authentication/jwt-authentications.md) — Provides middleware for Express applications to authenticate requests using signed JSON Web Tokens.
- [Request Token Validators](https://awesome-repositories.com/f/security-cryptography/access-control/panel-access-controls/token-access-restrictions/request-token-validators.md) — Validates token signatures and expiration on every request to secure API endpoints.
- [JWT Route Guards](https://awesome-repositories.com/f/security-cryptography/access-control/panel-access-controls/token-access-restrictions/request-token-validators/jwt-route-guards.md) — Acts as a route guard that verifies token signatures and expiration before allowing access to backend endpoints.
- [JSON Web Token Validators](https://awesome-repositories.com/f/security-cryptography/json-web-token-validators.md) — Provides a robust mechanism to validate the authenticity of JWTs and extract user attributes.
- [Token Signature Verification](https://awesome-repositories.com/f/security-cryptography/token-authentication/token-signature-verification.md) — Implements cryptographic signature verification to ensure the authenticity of JSON Web Tokens.
- [Token Validation Middleware](https://awesome-repositories.com/f/security-cryptography/token-validation-middleware.md) — Implements an Express middleware specifically for validating the authenticity and validity of JWTs.
- [Custom Extractors](https://awesome-repositories.com/f/security-cryptography/alternative-authentication-methods/authentication-method-configurations/header-and-cookie-credential-acceptors/custom-extractors.md) — Provides a customizable mechanism to extract authentication tokens from headers, cookies, or query parameters.
- [Request Credential Extractors](https://awesome-repositories.com/f/security-cryptography/alternative-authentication-methods/authentication-method-configurations/header-and-cookie-credential-acceptors/request-credential-extractors.md) — Includes a utility to retrieve authentication tokens from various request sources for validation.
- [Claim Mapping](https://awesome-repositories.com/f/security-cryptography/custom-attribution-tracking/authentication-claims/claim-mapping.md) — Maps decoded JWT payload attributes directly to the request object for downstream use in the application.
- [Key Resolution](https://awesome-repositories.com/f/security-cryptography/json-web-key-imports/key-resolution.md) — Dynamically resolves the correct public key from a set based on token headers at runtime.
- [Public Key Retrieval](https://awesome-repositories.com/f/security-cryptography/public-key-authentication/public-key-retrieval.md) — Fetches the public keys necessary to verify digital signatures at runtime based on token headers. ([source](https://github.com/auth0/express-jwt#readme))
- [Dynamic Key Retrieval](https://awesome-repositories.com/f/security-cryptography/public-key-authentication/public-key-verifiers/dynamic-key-retrieval.md) — Retrieves the required verification keys at runtime based on request attributes or token headers.
- [Token Revocation](https://awesome-repositories.com/f/security-cryptography/token-authentication/token-revocation.md) — Supports checking token identifiers against revocation lists to invalidate cryptographically valid tokens.
- [Authentication Token Extraction](https://awesome-repositories.com/f/security-cryptography/token-based-authentication/authentication-token-extraction.md) — Allows the retrieval of authentication tokens from non-standard request sources using custom logic. ([source](https://github.com/auth0/express-jwt#readme))
- [Expiring Tokens](https://awesome-repositories.com/f/security-cryptography/token-management/expiring-tokens.md) — Handles token expiration by allowing specific logic or custom error responses when a token has expired. ([source](https://github.com/auth0/express-jwt/blob/master/README.md))

### Software Engineering & Architecture

- [Request Interception Middleware](https://awesome-repositories.com/f/software-engineering-architecture/request-interception-middleware.md) — Functions as middleware that intercepts incoming HTTP requests to perform security validation before hitting application logic.